About
I’m Suchait Gaurav, a software architect who has spent years building and operating multi-tenant systems at scale — the kind with real customers, real compliance reviews, and real consequences when a boundary leaks.
TenantLayer exists because the same handful of mistakes kept appearing. Not exotic ones: a tenant left on a pooled connection, a scheduled job with no tenant bound, a policy that looked correct and never applied because the application connected as the table owner. Every one of them silent. Every one of them found the hard way.
The library is those mistakes, already made and already fixed, so that the next team does not have to make them in production.
TenantLayer is developed and published by Specmatics Technologies Pvt Ltd, India — the company I run. Commercial licences and invoices come from that entity, which is worth knowing if you need a supplier to raise a purchase order against.
I lead the design and engineering of TenantLayer myself, and the decisions described on this page are mine.
Why it is built the way it is
Isolation is enforced by Postgres, not by Java. That is a deliberate limit on my own ambition: an ORM filter constrains what the ORM asks for, while a row-level security policy constrains everything on the connection — including the native query, the bulk update, and the analyst with a psql session. If TenantLayer were removed tomorrow, the policies are plain SQL you own and your isolation would still hold.
Every isolation claim in the codebase is mutation-tested: after a test passes, the implementation is broken deliberately to confirm the test fails. It has caught something real every time — including a case where enabling virtual threads silently removed tenant propagation from every @Async method. That standard is written down in contributing, because it applies to everyone including me.
Where something is not built, or can still be bypassed, it is written down rather than omitted. A library that oversells its guarantees is worse than no library, because you would have written the checks yourself.
Free and paid
The core is Apache 2.0 and will stay that way. There will eventually be a paid tier, and one rule decides what goes where:
Free is correctness. Paid is operations, compliance and scale. Would a two-person startup need it before they have customers? Free. Would a team closing their first large enterprise deal need it? Paid.
The free core is never crippled to sell the paid one. Anything needed to build multi-tenancy correctly belongs in the free tier, and if something is missing from it, that is an omission worth an issue. The rule above is what the argument gets held up against.
There is no contributor licence agreement, deliberately — contributions stay Apache 2.0 and will not turn up behind a paywall.
Get in touch
Questions about using it belong in Discussions, where the answer helps the next person too. For anything commercial or private, use the contact form. For a vulnerability, please use private reporting.